Odd access activity

Roger Oberholtzer roger
Mon Aug 23 02:10:36 PDT 2004


I get the following in a server log quite often (more than once a day).
All that changes is the IP address. What they are up to? Could it just
be a probe? Trying a user called 'test', 'guest', 'admin' and 'user'?
If anyone else has such users on an externally connected machine, make
them secure for these users (at least). I am sure I am not the only
target of such a probe. I am tempted top make such a user and see what
they try. I wonder how I could see what password they are trying. Maybe
they are not trying one. Just a blank one. The names look NTish, so I
bet they are looking for unsecured Windows NT/2000/XP boxes. Anyone else
see these?

Aug 18 17:08:41 seaotter sshd[20626]: input_userauth_request: illegal
user test
Aug 18 17:08:41 seaotter sshd[20626]: Failed password for illegal user
test from 210.223.178.180 port 44600 ssh2
Aug 18 17:08:44 seaotter sshd[20627]: input_userauth_request: illegal
user guest
Aug 18 17:08:44 seaotter sshd[20627]: Failed password for illegal user
guest from 210.223.178.180 port 44913 ssh2
Aug 18 17:08:47 seaotter sshd[20628]: input_userauth_request: illegal
user admin
Aug 18 17:08:47 seaotter sshd[20628]: Failed password for illegal user
admin from 210.223.178.180 port 45150 ssh2
Aug 18 17:08:50 seaotter sshd[20629]: input_userauth_request: illegal
user admin
Aug 18 17:08:50 seaotter sshd[20629]: Failed password for illegal user
admin from 210.223.178.180 port 45385 ssh2
Aug 18 17:08:52 seaotter sshd[20630]: input_userauth_request: illegal
user user
Aug 18 17:08:52 seaotter sshd[20630]: Failed password for illegal user
user from 210.223.178.180 port 45623 ssh2


+????????????????????????????+???????????????????????????????+
? Roger Oberholtzer          ?   E-mail: roger at opq.se        ?
? OPQ Systems AB             ?      WWW: http://www.opq.se/  ?
? Nybrogatan 66 nb           ?    Phone: Int + 46 8   314223 ?
? 114 41 Stockholm           ?   Mobile: Int + 46 733 621657 ?
? Sweden                     ?      Fax: Int + 46 8   314223 ?
+????????????????????????????+???????????????????????????????+



More information about the Linux-users mailing list